AD-GPOREP-14 - GPO enforcement count should be investigated

Contributed by Michael SouleAll contributors →

Overview

Test-MtAdGpoEnforcementCount

Counts the number of GPOs that have enforced GPO links.

Why This Test Matters

• Detective control: counts GPOs with enforced links which indicates explicit policy delivery is configured.

Control Type

Operational

Security Recommendation

• Ensure enforcement aligns with security policy; adjust as needed for least privilege and correct policy propagation.

How the Test Works

• Fetches GPO state, filters for HasEnforcement, and reports total GPOs, number with enforcement, and the ratio.

Related Tests

• Test-MtAdGpoEnforcementCount.

Related links

• Microsoft Learn - Group Policy management
• ANSSI checkpoint: https://www.anssi.gouv.fr/

Test Metadata

Field	Value
Test ID	AD-GPOREP-14
Severity	Info
Suite	Active Directory
Category	Active Directory - GPO State
PowerShell test	Test-MtAdGpoEnforcementCount
Services	ActiveDirectory
Tags	AD, AD-GPOREP-14, AD.GPOState

Source

• Test: tests/ad/gpostate/Test.AD-GPOREP-14.ps1
• Documentation: tests/ad/gpostate/Test.AD-GPOREP-14.md